Web caches and indexing robots are examples of user agents who do not act
on behalf of one end user. The problem of access control when sharing
indexes or caches is not trivial for documents who have access control
based on IP number or domain name, since there is no indication of
access control being used for the particular document.
Several popular web servers permit users to create their own access control,
like Apache does with local .htaccess files, and the local webmaster
may not know about access restrictions. This excludes the use of robots.txt
file for sharing this information with indexing robots, and the caches
would not be helped.
Cache-control: private has been considered, but it does not
permit sharing information with those in the same realm.
If an extra header indicating that access control was used, is sent
with the document this problem would be solved.
With information of the access list, caches and indexes may still
be shared and give access to the appropriate information
without compromising security. Two access restrictions that easily
lend themselves to this are IP numbers and domain names.
Proposed new header
Restricted: ACL
If the definition of WWW-Authenticate is reused from HTTP/1.1,
the two special cases would be
Restricted: IPnr realm="129.215.0.0/255.255.0.0"
Restricted: Domain realm=".dcs.ed.ac.uk"
This header does not ensure the security of a document, but gives multi-user agents an opportunity to restrict access. If an unknown realm is encountered, the indexing robot or cache should treat the document as restricted and not share information.
Ingrid
(who would rather have sent this message to the HTTP-extentions group or the web cache protocols group or the HTTPSEC group or the shared indexing group)
--
Ingrid.Melve@uninett.no UNINETT, N-7034 Trondheim, Norway
Phone +47 73 55 79 07 Fax +47 73 55 79 01
http://domen.uninett.no/~im/eng.html
"Sometimes it is better to light a flamethrower than curse the darkness"